Feed the Worms Who Write Worms to the Worms

The economic logic of executing computer hackers.

If we execute murderers, why don't we execute the people who write computer worms? It would probably be a better investment.

Let's do the math. What do we get out of executing a murderer? Deterrence. A high-end estimate is that each execution deters about 10 murders. (The highest estimate I've ever seen is 24 murders deterred per execution, but the closest thing to a consensus estimate in the econometric literature is about eight.) That's 10 lives saved, with a value—again a high-end estimate—of about $10 million apiece. (The closet thing to a consensus estimate in the economics literature is about $7 million per life. I am rounding up.) So let's say the benefit of executing a murderer is roughly 10 times $10 million, or $100 million—and that's probably at the high end.

Advertisement

Compare that to the benefit of executing the author of a computer worm, virus, or Trojan. There seems to be no good name for such people, so I'll make one up—at least until some reader sends in a better suggestion, I'll call them "vermiscripters." It's estimated that vermiscripting and related activities cost the world about $50 billion a year. So if a single execution could deter just one-fifth of 1 percent of all vermiscripting for just one year, we'd gain the same $100-million benefit we earn by executing a killer. Anything over one-fifth of 1 percent, and any effects that last beyond the first year, are gravy.

So much for benefits. What about costs? The cost of an execution is one life—usually (one hopes) the life of the guilty, but occasionally the life of a wrongly convicted innocent. The question is: Which is worth more: the life of the average convicted murderer or the life of the average convicted vermiscripter?

Plausibly, the latter. Compared to murderers, vermiscripters might be easier to rehabilitate (the author of the Sasser worm is, by all reports, still a teenager) and probably have more skills that can be put to good use. (Offsetting this, though, is the prospect that those same skills can be put to further bad use.) Let's bias things very strongly against the conclusion I'm driving at by valuing the average murderer's life at zero and the average vermiscripter's life at $100 million—the same value we earlier attributed to 10 lives.

Then to rate the vermiscripter's execution as a better investment than the murderer's, you'd have to expect it to deter at least $200 million worth of computerized vandalism—enough to cover the $100 million value of executing the murderer plus the $100 million value of the vermiscripter's life. That's twice our earlier estimate, but still just two-fifths of 1 percent of one year's worth of worm and virus damage—and still a plausibly easy hurdle to clear.

Advertisement

Conclusion: On a pure cost-benefit basis, we should be quicker to execute a vermiscripter than a murderer. But of course we're not. Which raises the question: Why not?

Here's one answer: "These things can't possibly be reduced to numbers. Who cares if some economist said a human life was worth $7 million or $8 million or $10 million? A chemist will tell you that the elements in your body have a collective market value of about $10. You might find these numbers interesting in some abstract academic sort of way, but they have nothing at all to do with making wise policy decisions."

The problem with that answer is that it's wrong. To understand why it's wrong, you have to understand how economists come up with these numbers in the first place. When we say that a human life is worth $10 million, we mean nothing more or less than this: A typical person, faced with a 1–in-10-million chance of death, seems to be willing to pay about a dollar to eliminate that risk. We know this not from theory but from observation—by looking, for example, at the size of the pay cuts people are willing to take to move into safer jobs. On this basis, Harvard professor Kip Viscusi estimates the value of a life at $4.5 million overall, $7 million for a blue-collar male and $8.5 million for a blue collar female. (Viscusi acknowledges that it's puzzling for a blue-collar life to be worth more than a white-collar life, but that's what the data show.)

If we can deter one random murder in America, we make you a little bit safer: Your chance of being a murder victim shrinks by about 1 in 300 million (because that's how many Americans there are). If we can execute one killer and deter 10 random murders, the enhancement to your safety is multiplied by 10: Your chance of being a victim shrinks by 1 in 30 million. When we say that your life is worth $10 million, we mean precisely that you'd be willing to pay about one-thirty-millionth of $10 million—about 33 cents—for that much extra safety. (Actually, you'd probably be willing to pay slightly less, because each execution, while making you safer on the street, also enhances the risk that you yourself will be falsely convicted and executed someday.)

Advertisement

On the other hand, suppose we can execute one vermiscripter and thereby eliminate, oh, say, 1 percent of all computer viruses for one year. Assuming that half the $50 billion cost of malicious hacking is concentrated in the United States and that you bear your proportionate share of that cost, we're putting about 83 cents in your pocket.

Which would you rather have, the safety or the cash? Almost every American would take the cash; that's exactly what we learn from studies like Viscusi's.

Executing the murderer means giving you the safety. Executing the vermiscripter means giving you the cash. You'd rather have the cash than the safety. Ergo, executing the vermiscripter is better policy.

There's one exception to this reasoning: Maybe there's an alternative and less drastic punishment that is highly effective against vermiscripters and not against murderers. If we can effectively deter malicious hackers by cutting off their supply of Twinkies or crippling their EverQuest avatars, then there's no need to fry them. Whether that would work is an empirical question.

Some might argue that capital punishment has moral costs and benefits beyond its practical consequences in terms of lives lost and lives saved. Those who make such arguments will want to modify a lot of the calculations in this column. As for myself, I hold that the government's job is to improve our lives, not to impose its morality. In this, I take my stand with the president of the United States, who, in a 2000 debate against Al Gore, said quite explicitly that nothing other than deterrence can justify the death penalty.

There's also the fact that all the arithmetic in this column is very much back-of-the-envelope. I implicitly assumed that we're all equally likely to be random murder victims when in fact some of us (i.e., the poor) are more susceptible than others. I used numbers that are rough approximations to the truth. And I probably omitted a consideration or two that I'm sure I'll hear about from astute readers.

But this essential point remains: Governments exist largely to supply protections that, for one reason or another, we can't purchase in the marketplace. Those governments perform best when they supply the protections we value most. We can measure their performance only if we are willing to calculate costs and benefits and to respect what our calculations tell us, even when it's counterintuitive. Any policymaker who won't do this kind of arithmetic is fundamentally unserious about policy.